Quantum Error Correction Via Codes Over GF (4 ... - Caltech Authors

IEEE TRANSACTIONS ON INFORMATION THEORY, VOL. 44, NO. 4, JULY 1998

1369

Quantum Error Correction Via Codes Over GF A. Robert Calderbank, Fellow, IEEE, Eric M. Rains, P. W. Shor, and Neil J. A. Sloane, Fellow, IEEE

Abstract— The problem of finding quantum-error-correcting codes is transformed into the problem of finding additive codes over the field GF (4) which are self-orthogonal with respect to a certain trace inner product. Many new codes and new bounds are presented, as well as a table of upper and lower bounds on such codes of length up to 30 qubits. Index Terms— Codes, additive; codes, quantum; codes, quaternary; codes, self-orthogonal, geometry, orthogonal; geometry, symplectic; group, Clifford.

I. INTRODUCTION

T

HE relationship between quantum information and classical information is a subject currently receiving much study. While there are many similarities, there are also substantial differences between the two. Classical information cannot travel faster than light, while quantum information appears to in some circumstances (although proper definitions can resolve this apparent paradox). Classical information can be duplicated, while quantum information cannot [29], [77]. It is well known that classical information can be protected from degradation by the use of classical error-correcting codes [54]. Classical error-correcting codes appear to protect classical information by duplicating it, so because of the theorem that a quantum bit cannot be cloned, it was widely believed that these techniques could not be applied to quantum information. That quantum-error-correcting codes could indeed exist was recently shown by one of us [65]. Two of us [17] then showed that a class of good quantum codes could be obtained by using a construction that starts with a binary containing its dual Independently, Steane linear code also discovered the existence of quantum codes [73] and the same construction [72]. At around the same time, Bennett et al. [4] discovered that two experimenters each holding one component of many noisy Einstein–Podolsky–Rosen (EPR) pairs could purify them using only a classical channel to obtain fewer nearly perfect EPR pairs. The resulting pairs can then be used to teleport quantum information from one experimenter to the other [3]. Although it was not immediately apparent, these two discoveries turned out to be different ways of looking at the same phenomenon. A purification protocol that uses only a one-way classical channel between the experimenters can be converted into a quantum-errorManuscript received July 15, 1996; revised December 4, 1997. The work of E. M. Rains was performed while he was with the Institute for Defense Analyses, Princeton, NJ USA. The material in this paper was presented in part at the IEEE International Symposium on Information Theory, Ulm, Germany, 1997. The authors are with AT&T Laboratories–Research, Florham Park, NJ 07932-0971 USA. Publisher Item Identifier S 0018-9448(98)03754-7.

correcting code, and vice versa [5]. After these discoveries, a number of improved quantum codes were soon found by various researchers. The setting in which quantum-error-correcting codes exist is the quantum state space of qubits (quantum bits, or two, and it has a natural state quantum systems). This space is decomposition as the tensor product of copies of , where each copy corresponds to one qubit. We noticed that the known quantum codes seemed to have close connections to a finite , known as a Clifford group of unitary transformations of This group contains all the group, and denoted here by transformations necessary for encoding and decoding these quantum codes. It is also the group generated by fault-tolerant bitwise operations performed on qubits that are encoded by certain quantum codes [17], [66], [72]. Investigation of the connection between this group and existing quantum codes has led us to a general construction for such codes which allows us to generate many new examples. The initial results of this study were reported in [16]. However, it is very hard to construct codes using the framework of [16]. In the present paper we develop the theory to the point where it is possible to apply standard techniques from classical coding theory to construct quantum codes. Some of the ideas in [16] (although neither the connections with the Clifford group nor with finite geometries or fields) were discovered independently by Gottesman [36]. The paper is arranged as follows. Section II transforms the problem into one of constructing a particular type of binary space (Theorem 1). Section III shows that these spaces in turn are equivalent to a certain class of additive codes over GF (Theorem 2). The rest of the paper is then devoted to the study of such codes. Their basic properties are described in the remainder of Section III, and Section IV gives a number of general constructions. Sections V–VII then deal with cyclic and related codes, self-dual codes, and bounds. Until now little was known about general bounds for quantum codes. The linear programming bound (Theorems 21 and 22) presented in Section VII appears to give quite sharp bounds for those codes. This can be seen in the main table of the paper, Table III, given in Section VIII, which is based on the results of the earlier sections. Although there are still a large number of gaps in the table, the upper and lower bounds are generally not too far apart and there are a considerable number of entries where the parameters of the best codes are known exactly. Section IX contains an update on developments that have occurred since the manuscript of this paper was first circulated. In order to reduce the length of the paper, proofs which either use standard techniques in coding theory or are straightforward will be omitted.

0018–9448/98$10.00  1998 IEEE

1370

IEEE TRANSACTIONS ON INFORMATION THEORY, VOL. 44, NO. 4, JULY 1998

II. FROM QUANTUM CODES TO BINARY SPACES Recall from Section I that the quantum state space of qubits is The idea behind quantum error correction is to encode quantum states into qubits so that errors or decoherence in a small number of individual qubits will have little or no effect on the encoded data. More precisely, an encoding of qubits into qubits is taken to be a linear mapping of onto Since the error correction a -dimensional subspace of properties of this mapping depend only on the subspace rather than on the mapping, the subspace itself will be called the quantum-error-correcting code. Correction of arbitrary errors in an arbitrary -dimensional subspace is in general infeasible, since errors which map states in the subspace to other states in the subspace cannot be corrected (because the latter are also permissible states). To overcome this, we make use of the tensor product into copies of Quantum-errordecomposition of correcting codes are subspaces oriented so that any error in a relatively small number of qubits moves the state in a direction perpendicular to the coded subspace, and thus can be corrected. A bit error in an individual qubit corresponds to applying to that qubit, and a phase error the Pauli matrix The third Pauli matrix, to the Pauli matrix , corresponds to a combination of tensor products of bit and phase errors. The group and where each is describes the possible errors in qubits. one of is a subgroup of the unitary group In general, there is a continuum of possible errors in qubits, and there are errors in sets of qubits which cannot be described by a product of errors in individual qubits. For the purposes of quantum error correction, however, we need consider only the three types of and since any error-correcting code which errors corrects of these errors will be able to correct arbitrary errors in qubits [5], [34], [47]. We do not go into the details of this result, but essentially it follows from the fact that the and form a basis for the space of all matrices matrices, and so the tensor products of of these errors matrices. form a basis for the space of Our codes will thus be tailored for the error model in which each qubit undergoes independent errors, and the three errors and are all equally likely. The results of [5], [34], and [47] show that any code which corrects these types of quantum errors will be able to correct errors in arbitrary error models, assuming the errors are not correlated among large numbers of qubits and that the error rate is small. For other error models it may be possible to find codes which correct errors more efficiently than our codes do; this is not discussed in this paper. This section and Section III show how to convert the problem of finding quantum-error-correcting codes into one of finding certain types of classical error-correcting codes. We do this in two stages. The first stage reduces the problem from a quantum (continuous) one to a classical (discrete) problem in finite geometry. The second stage converts the latter to a coding theory problem.

The finite-geometry problem can be summarized as follows. Let denote a -dimensional binary vector space, whose and which is equipped with the elements are written inner product (1) This is a symplectic inner product, since it satisfies

Define the weight of to be the and number of coordinates such that at least one of is . The distance between two elements is defined to be the weight of their difference. Then we have the following theorem, which is an immediate consequence of [16, Theorem 1]. Since the discussion in [16] was necessarily very condensed, we give the proof of this theorem below. is an -dimensional linear Theorem 1: Suppose (with respect subspace of which is contained in its dual to the inner product (1)), and is such that there are no vectors of in Then there is a quantum-error-correcting weight code mapping qubits to qubits which can correct errors. We will describe such a quantum-error-correcting code by , and call the minimal saying it has parameters distance of the code. A code obtained via Theorem 1 will be called an additive code. Almost all quantum-error-correcting codes known at the present time are additive. However, we will have occasion to discuss more general codes in this paper, and to indicate a code with minimal will use the symbol states into qubits. Of distance (see [67]) that encodes code is also an code. course, an Readers who are most interested in the codes themselves could now proceed directly to Section III. Proof: To motivate the following discussion we begin by describing classical binary linear codes from a slightly unusual is, of course, a linear subspace perspective. A linear code , where But can also be regarded as of the group of possible errors, i.e., is also a subgroup of the has the following error group. Furthermore, this subgroup characterization in terms of the error group: an error is in precisely when translation by takes codewords to codewords and thus cannot be detected. corrects a set of errors if and only if the sum of any two errors can be detected, i.e., lies outside , except that the sum may be the trivial error , which, while it cannot be detected, has no effect. In the quantum setting, it is possible for a nontrivial error to be undetectable and yet have no impact on the encoded state. This suggests that we should attempt to construct a quantum code from a pair of subgroups of the quantum error One subgroup (which we will call ) specifies the group undetectable errors, while the other (called ) is the subgroup consisting of errors that have no effect on the encoded of is the analog of the zero subgroup in the classical state. coding case.

CALDERBANK et al.: QUANTUM ERROR CORRECTION VIA CODES OVER GF

1371

It will turn out to be important to require that every element commutes with This implies in particular that of is Abelian. So we are led to consider when elements of commute. has order and center The group1 The quotient group is an elementary , and hence a binary vector space. Abelian group of order and label the standard basis Let denote the vector space by Every element can be written of uniquely in the form

it induces a nontrivial action on the characters, and so acts faithfully. It follows that the orbit of any given character must have If has dimension size On the other hand, there are characters of such that , since the quotient of any two such characters is a Thus acts transitively. It follows that character of each eigenspace must have the same dimension, namely, It remains to determine the error-correcting properties of the In the classical setting, we can correct a set of errors code when the quotient (really, difference) of any pair of the errors , that is, either can be detected or lies outside the set acts trivially. Analogously, we have the following lemma.

(2) where for The element indicates that there are and phase errors in bit errors in the qubits for which the qubits for which If are given by (2) then , where the This induces the symplectic inner product sign is given in (1)

where we write for the image of in Two commute if and only if their images in are elements in orthogonal with respect to this inner product. of is said to be totally isotropic if for A subspace the symplectic inner product A all is commutative if and only if its image subgroup of in is totally isotropic. The dimension of a totally isotropic The groups and subspace is at most are examples of subgroups of whose have dimension images With , the subgroup of errors that have no effect, we define to be the lift of to or, equivalently, we define to be the centralizer of in We then take to be , will be the group of undetectable errors. that is, is Abelian, its elements can be simultaneously Since into ordiagonalized. This induces a decomposition of to act trivially on the thogonal eigenspaces. In order for code, it is necessary for the code to lie entirely in one of these to preserve the code, eigenspaces. Since we also want we take the code to be one of the eigenspaces for , to be (say). As already mentioned, we call quantum denoted by codes obtained in this way additive codes. To each eigenspace of there corresponds a homomorphism , under which each element of is mapped to the is a character of , and corresponding eigenvalue. Then Every element normalizes , and so conjugation by induces an action on characters. Since commutes with , elements of induce the trivial action on the characters. negates the value of the character at Any element outside each element of with which it anticommutes. In particular, 1 “E ” stands for “error group,” but also serves as a reminder that E is essentially an extraspecial 2-group. The association of extraspecial 2-groups with finite orthogonal spaces, underlying all of this section, is a standard one in group theory (cf. [1, Theorem 23.10] and [41, Theorem 13.8]). We have made further use of this theory in [68], [13].

Lemma 1: An additive quantum-error-correcting code with associated space can correct a set of errors precisely when for all Proof: Suppose an error has occurred. In order we must find some error such that to correct acts trivially on , i.e., In other words, we The hypothesis of the Lemma must determine the coset contains at most one coset of implies that every coset of intersecting It therefore suffices to determine the coset Recall that permutes the eigenspaces of regularly. If we measure in which eigenspace we now lie (which we can do because distinct eigenspaces are orthogonal) we can This measurement has no effect on immediately read off the state, since the state lies inside one of the eigenspaces. and are two errors such On the other hand, suppose Any correction procedure must take any that to Since state so is corrected to However, since , such that is not proportional there is a state to and we have failed to correct It follows from the Lemma that if we let be the minimal , the code can correct the set of all errors of weight of We have now completed the proof weight at most of Theorem 1: maps qubits into qubits and can correct errors. Decoding: Recall that the eigenspaces of are in one-toone correspondence with characters of satisfying To determine which eigenspace contains a given state it is is a therefore enough to determine this character. Since homomorphism, it suffices to compute the character on a basis Each element of the basis thus provides one bit of for information; the collection of these bits is the syndrome of the error. Of course, as in classical coding theory, identifying the most likely error given the syndrome can be a difficult problem. (There is no theoretical difficulty, since in principle an exhaustive search can always be used.) The Clifford Groups: Encoding is carried out with the help of a family of groups called Clifford groups.2 There are both ) versions complex (denoted by ) and real (denoted by of these groups. 2 We follow Bolt et al. [6], [7] in calling these Clifford groups. The same name is used for a different family of groups by Chevalley [19] and Jacobson [42].

1372

IEEE TRANSACTIONS ON INFORMATION THEORY, VOL. 44, NO. 4, JULY 1998

The complex Clifford group is defined to be the subgroup in that contains entries from of the normalizer of The full normalizer of in has an infinite center consisting of the elements Although these central elements have no effect quantummechanically, we wish to work with a finite group. The , since smallest coefficient ring we can use is

The real Clifford group is the real subgroup of , or, If equivalently, the subgroup of with entries from to be the real subgroup of , then is the we define in the orthogonal group The group normalizer of consists of the tensor products , where is one of is an extraspecial each and center , and group with order For many applications it is simpler to work and rather than and with the real groups The following are explicit generators for these groups. First, is generated by , all matrices of the form (3) where

and all matrices where is any -valued Similarly, is generated by , (3) quadratic form on , where is now any and all matrices -valued quadratic form on We also record some further properties of and , is isomorphic to the symplectic group • (the group of matrices over preserving the inner product (1) [23]). has order •

•

is isomorphic to the orthogonal group [23]. has order •

These groups are discussed further in the final paragraphs of the present paper (see Section IX, item xv)). Encoding an Additive Code : Since acts transiacts transitively on tively on isotropic subspaces, and acts eigenspaces for a given subspace, the Clifford group transitively on additive codes. One such code is the trivial code with generators corresponding to the subspace By transitivity we can find an element which takes the trivial code to Of course, is not unique. Cleve and Gottesman [21] have given explicit gate descriptions for doing this. Pure Versus Degenerate: In the quantum coding literature there is an important distinction made between degenerate and nondegenerate codes. A nondegenerate code is one for which different elements of the set of correctable errors produce linearly independent results when applied to elements of the code. We will find it convenient to introduce a second dichotomy, between pure and impure codes. We will say that a code is pure if distinct elements of the set of correctable errors produce orthogonal results. It is straightforward to verify that, for additive codes, “pure” and “nondegenerate” coincide. In general, however, a pure code is nondegenerate but the converse need not be true. For many purposes the pure/impure distinction is the correct one to use for generalizing results from additive to nonadditive codes, and we will therefore use this terminology throughout the paper. we may proceed as Bases: To find an explicit basis for containing follows. Choose a maximal isotropic subspace , and consider the one-dimensional eigenspaces of We obtain a basis for by selecting those eigenspaces for which the corresponding character agrees with the given character on (Equivalently, we may take all the eigenspaces lying inside ) The choice of is of course not unique, and we have the same freedom in choosing a basis as we did earlier when choosing the element of the Clifford group. We conclude this section by restating Theorem 1 in more detail. is an -dimensional linear Theorem 1 : Suppose (with respect subspace of which is contained in its dual to the inner product (1)), and is such that there are no vectors in Then by taking an eigenspace (for of weight any chosen linear character) of , we obtain a quantum-errorcorrecting code mapping qubits to qubits which can correct errors.

III. FROM BINARY SPACES TO CODES OVER GF •

acts on as the symplectic group and acts on as the orthogonal group The groups and have arisen in several different contexts, and provide a link between quantum codes, the Barnes–Wall lattices [6], [7], [76], the construction of orthogonal spreads and Kerdock sets [12], the construction of spherical codes [43], [69], [70], and the construction of Grassmannian packings [68], [13]. They have also occurred in several purely group-theoretic contexts—see [12] for references.

As is customary (cf. [54]) we take the Galois field GF to consist of the elements with and conjugation defined by ; the trace GF takes to The Hamming map GF , written , is the number weight of a vector of nonzero components, and the Hamming distance between GF is The minimal of Hamming distance between the members of a subset will be denoted by GF

CALDERBANK et al.: QUANTUM ERROR CORRECTION VIA CODES OVER GF

To each vector

we associate the vector GF It is immediate that the weight of is equal to the Hamming weight of , and the distance is equal to between vectors The symplectic inner product of and (see (1)) is equal to , where the bar denotes conjugation in GF , since

If is a linear subspace of then is a subset which is closed under addition. We shall refer of GF as an additive code over GF , and refer to it as an to code if it contains vectors. If is also closed under multiplication by , we say it is linear. GF will be The trace inner product of vectors denoted by (4) additive code, its trace-dual, or simply If is an dual, is defined to be

1373

Theorem 3: A linear code is self-orthogonal (with respect to the trace inner product (4)) if and only if it is classically self-orthogonal with respect to the hermitian inner product. is Proof: The condition is clearly sufficient. Suppose let self-orthogonal. For Then implies , and implies , so The following terminology applies generally to additive We specify an additive code by codes over GF generator matrix whose rows are giving either a generators for the code, i.e., span the code additively, or by If the code listing such generators inside diamond brackets generator matrix will suffice, whose rows is linear a are a GF -basis for the code. denote the group of order generated by permuLet tations of the coordinates, multiplication of any coordinates by , and conjugation of any coordinates. Equivalently, is the wreath product of by generated by permutations of the coordinates and arbitrary permutations of the nonzero in each coordinate. preserves weights elements of GF of and trace inner products. Two additive codes over GF length are said to be equivalent if one can be obtained from The subgroup of the other by applying an element of fixing a code is its automorphism group The is then equal to number of codes equivalent to (6)

GF

for all

is an code. If we say Then then is self-dual. self-orthogonal, and if Theorem 1 can now be reformulated.

(5) is

Theorem 2: Suppose is an additive self-orthogonal sub, containing vectors, such that there code of GF in Then any eigenspace are no vectors of weight is an additive quantum-error-correcting code with of parameters We say that is pure if there are no nonzero vectors of in ; otherwise, we call impure. Note that weight the associated quantum-error-correcting code is pure in the is pure. We also say sense of Section II if and only if that an additive quantum-error-correcting code is linear if the is linear. associated additive code codes we allow , adopting When studying code the convention that this corresponds to a self-dual in which the minimal nonzero weight is In other words, code is “pure” by convention. An code an is then a single quantum state with the property that, when coordinates, it is possubjected to a decoherence of sible to determine exactly which coordinates were decohered. Such a code might be useful for example in testing whether certain storage locations for qubits are decohering faster than they should. These codes are the subject of Section VI. that have been studied before this Most codes over GF have been linear and duality has been defined with respect to We shall refer to such codes the Hermitian inner product as classical.

We determine the automorphism group of an tive code by the following artifice. We map binary linear code by applying the map

addito a

to each generator of Let denote the code Using a program such containing all vectors, and form as MAGMA [8]–[10] we compute the automorphism groups and ; their intersection of the binary linear codes is isomorphic to Any additive code is equivalent to one with generator matrix of the form

where denotes an identity matrix of order , is an is a binary matrix, and An arbitrary matrix, code is called even if the weight of every codeword is even, and otherwise odd. Theorem 4: An even additive code is self-orthogonal. A self-orthogonal linear code is even. Proof: The first assertion holds because (7) for all

GF

, and the second because (8)

1374

IEEE TRANSACTIONS ON INFORMATION THEORY, VOL. 44, NO. 4, JULY 1998

The weight distribution of an additive code is the where is the number of vectors in sequence of weight It is easy to see that the weight distribution of , for , is the same as that of , and any translate so the minimal distance between vectors of is equal to the The polynomial minimal nonzero weight in

is the weight enumerator of

(cf. [54]).

is an additive code with weight Theorem 5: If , the weight enumerator of the dual code enumerator is given by Proof: This result, analogous to the MacWilliams identity for linear codes, follows from the general theory of additive codes developed by Delsarte [28], since our trace inner product is a special case of the symmetric inner products considered in [28]. IV. GENERAL CONSTRUCTIONS In this section we describe some general methods for modifying and combining additive codes over GF The direct sum of two additive codes is defined in the natural way

In this way we can form the direct sum of two quantumand error-correcting codes, combining codes to produce an code, where An additive code which is not a direct sum is called indecomposable. code exists. Theorem 6: Suppose an then an code exists. a) If then an b) If the code is pure and code exists. or if and the code is pure, then an c) If code exists. then an code exists. d) If and the associated code contains a vector of e) If code exists. weight then an and be the associated and Proof: Let additive codes, respectively, with a) Form the direct sum of with The resulting code is impure (which is why the construction ). fails for (cf. [54]) by deleting the first coordinate, b) Puncture code (say) with minimal obtaining an The dual of consists of the vectors distance at least such that , and so is contained in c) There are and additive codes and with d) Take or , so that or The words in arise from truncation of Any words in of weight less than words in either begin with or , and so are not in , or begin with Words of a or , and so (after truncation) are in

weight in beginning with become words of weight , so the minimal distance in general is reduced by . The proof of e) is left to the reader. To illustrate Part a) of the theorem, from the Hamcode. ming code (see Section V) we obtain an impure On the other hand, exhaustive search (or integer programming, exists. This is see Section VII) shows that no pure the first occasion when an impure code exists but a pure one does not. code, also impure not equivalent to the A second first, is generated by

Up to equivalence, there are no other codes. then there is a If we have additional information about more powerful technique (than that in Theorem 6, Part d)) for shortening a code. be a linear self-orthogonal code over Lemma 2: Let Suppose is a set of coordinates of such that every GF codeword of meets in a vector of even weight. Then the code obtained from by deleting the coordinates in is also self-orthogonal. Proof: Follows from Theorem 4. Theorem 7: Suppose we have a linear code with code Then there exists a linear associated code with and for any such in the dual of the that there exists a codeword of weight binary code generated by the supports of the codewords of Proof: Let be the support of such a word of weight Then satisfies the conditions of Lemma 2, and deleting these coordinates gives the desired code. For example, consider the in the following section. The code the supports of the codewords in with weight enumerator

Hamming code given is an code, and generate a binary code

The MacWilliams transform of this ([54, Theorem 1, p. 127]) shows that the dual binary code contains vectors of weights , – , and . From Theorem 7, we may deduce the existence codes (see the entries of labeled in the main table in Section VIII). There is an analog of Theorem 7 for additive codes, but the construction of the corresponding binary code is somewhat more complicated. The direct sum construction used in Theorem 6 Part a) can be generalized. and Theorem 8: Given two codes with we can construct an code, where Proof: Consider the associated codes with paand with paramrameters Let be the composition eters to with any innerof the natural map from to GF Then we product-preserving map from

CALDERBANK et al.: QUANTUM ERROR CORRECTION VIA CODES OVER GF

1375

Proof: It is easily verified that

is additive and that

Another construction based on binary codes due to Gottesman [36] can be generalized as follows. be the classical binary simplex code Theorem 10: Let , dimension , and minimal distance of length [54, Ch. 14]. Let be any fixed-point-free automorand let be the additive code phism of with a generated by the vectors appended, together with the vectors of length This yields a quantum code. We omit the proof. Fig. 1. Generator matrices for a (25; 224 ) linear code (above the line) and its dual, a (25; 226 ) linear code (all rows), corresponding to a [[25; 1; 9]] quantum code.

form a new code If

with contributes need have weight only

to the weight of , but If , and Different choices for may produce inequivalent codes. Choosing corresponds to choosing an encoding method for

at least

has the following properties (again, We can show that to save space, the proofs are omitted). has weight enumerator i) For any choice of

For example, if the second code is the code with generator matrix [1], the new code has parameters , as in Theorem 6 Part a). A different code is obtained if we take the second code to be the code with generator matrix [11]. In particular, the second code mentioned above may be obtained in this manner. Theorem 8 can be used to produce an analog of concatenated is an code such codes in the quantum setting. If code has minimal nonzero that the associated weight considered as a block code over an alphabet of size , and is an code, then encoding each block using (as in Theorem 8) produces an of concatenated code. A particularly interesting example is obtained by concateHamming code (see Section V) with itself. nating the , and let the associated linear code We take have generator matrix

Then we obtain a code for which the associated and linear codes have the generator matrices shown in Fig. 1. Although the Hamming code is pure, the concatenated code is not. The construction of quantum codes used in [17] and [72] can be restated in the present terminology (and slightly generalized). be binary linear codes. By taking Theorem 9: Let in Theorem 2 we obtain an code, where

ii) The vectors of weight generate a subcode of dimension . is constructed using the automorphism , iii) Suppose using Then is equivalent to if and and is conjugate under to one of only if (9) has a normal subgroup iv) The automorphism group of which is a semidirect product of the centralizer of in with , the index being the number of elements of (9) that are conjugate to v) is linear precisely when satisfies Before giving some examples, we remark that is , and conjuisomorphic to the general linear group are determined by their elementary gacy classes of divisors. So the most convenient way to specify is by listing its elementary divisors. , there is a unique choice for , with elementary For , and so there is a unique , with parameters divisor . Then has order , and is a semidirect with the general affine group product of a cyclic group For , there are three distinct codes , with param. The corresponding elementary divisors for eters are as follows: (twice). This produces a linear code, with a) (In general, the code is linear precisely when all the elementary divisors are equal to ) , with b) c) , with For there are two distinct codes, with parameters . The corresponding elementary divisors are a) b)

and , with

, with

1376

IEEE TRANSACTIONS ON INFORMATION THEORY, VOL. 44, NO. 4, JULY 1998

Theorem 12: Suppose there is a pure code with additive code , and a pure associated code with associated code , such that Then there code, where exists a pure

Fig. 2. Generator matrix for (40; 27 ) additive code, producing a [[40; 33; 3]] quantum code.

(if

Gottesman [38] used just a single , which he took to be is even)

while if is odd the first row is complemented. Gottesman’s ) and b) (for codes correspond to those labeled c) (for ). The codes in Theorem 10 can be extended. Theorem 11: For code, where is

there exists an

even

odd

Sketch of proof: The corresponding (say) has weight enumerator code

Proof: Take to be the consisting of the vectors bar denotes concatenation. Then

has minimal distance rem 33].

additive code where the

, by [54, Ch. 1, Theo-

For example, by combining the and codes shown in Table II of the next section we obtain a code. Concerning the structure of additive but nonlinear codes, it is pointless to simply add one generator to a linear code. is an linear code, and is an For if additive code with minimal distance , then it is also has easy to show that the linear code minimal distance We end this section by listing some trivial codes. An code exists for all An code exists provided , if is even, or if is odd. provided V. CYCLIC

additive

AND

RELATED CODES

An constant

even or odd We take and to be the additive codes corresponding and codes already mentioned. For to the , let be as in Theorem 10, and let be the subcode codewords in Finally, let be consisting of the weight and (note that both any isomorphism between to consist are spaces of dimension ). Define a new code , where and of all vectors A simple counting argument verifies that has the claimed weight distribution. By applying Theorem 5 we find that has minimal distance 3. Theorem 11 was independently discovered by Gottesman [38]. The resulting codes, like those constructed in Theorem 10, are pure and additive but in general are not linear. For we obtain the Hamming codes of Section V as even well as nonlinear codes with the same parameters. For odd we obtain codes. A additive code corresponding generator matrix for the code is shown in Fig. 2. to a ” construction for binary codes [54, p. 76] has The “ an analog for quantum codes.

additive code is constacyclic if there is a (which in our case will be , , or ) such that implies If the code is cyclic. Besides these standard terms from the classical theory, we also need a new concept: if implies ; the code will be called conjucyclic. We begin with linear codes. If vectors are represented by polynomials in the natural way, a linear constacyclic code is represented by an ideal in the ring of polynomials modulo ([54], [49]). The latter is a principal ideal ring, so the code consists simply of all multiples of a single generator , which must divide We assume polynomial is odd. Theorem 13: A linear cyclic or constacyclic code with is self-orthogonal if and only if generator polynomial

where if

(10) We omit the elementary proof (cf. [15]). Note that

CALDERBANK et al.: QUANTUM ERROR CORRECTION VIA CODES OVER GF

The operation induces an involution on factors of so we can write

, (11)

and are all distinct and Then where the of generates a self-orthogonal linear a divisor is divisible by each of constacyclic code if and only if pair. the ’s and by at least one from each over GF has Example: The classical Hamming code , contains codewords, and has length [52], [54]. The dual code minimal distance , for is a self-orthogonal linear code, and the corresponding , where quantum code has parameters and are cyclic if is even, constacyclic if is odd. For example, when we can take to have , a divisor of , generator polynomial we take , a divisor and when These codes meet the sphere-packing bound (14) of (see Section VII) with equality. The smallest Hamming code, code, was independently discovered in the present a context by [5] and [50]. See also [16]. Hamming codes correct single errors. In the classical theory, the generalizations of Hamming codes that correct multiple errors are known as Bose–Chaudhuri–Hocquengham (BCH) codes [54]. A similar generalization yields multiple-errorcorrecting quantum codes. Rather than giving a complete analysis of these codes, which involves a number of messy details, we simply outline the construction and give some examples. These quantum BCH codes may be cyclic or constacyclic. In the cyclic case we let be a primitive th root of unity in some extension field of GF , and write each factor in (11) as the zero set being a cyclotomic coset modulo under multiplication by (see [54, Ch. 7]). The zero set associated with is then We choose a minimal subset of the ’s subject to the conditions in that a) there is an arithmetic progression of length the union of its zero sets, for which the step size is relatively is chosen, is not. Let be the prime to , and b) if cyclic code whose generator polynomial is the product of the ’s. Then a) guarantees that has minimal distance at least and b) guarantees that In this way we obtain , a quantum-error-correcting code with parameters where A similar construction works in the constacyclic case, only th root of unity. now we choose to be a primitive , most of the have In the special case when degree , and we obtain a sequence of cyclic or constacyclic is at least , begins codes which provided

For example, when

we obtain and

codes.

1377

We now discuss additive (but not necessarily linear) codes. Note that an additive constacyclic code (with or ) is necessarily linear. Theorem 14: additive cyclic code has two generaa) Any tors, and can be represented as where are binary polynomials, and divide divides and b) If is another such representaand tion, then c)

is self-orthogonal if and only if

Proof: obtained a) Consider the map by taking traces componentwise. The kernel of this map is a binary cyclic code, so can be represented uniquely as , where divides The image of the map The original code is similarly a binary cyclic code and some inverse image of , say is generated by Finally, if did not divide , would be a binary vector then not in , a contradiction. of We omit the proof of b). c) One readily verifies that the inner product of the vectors and is given by corresponding to the constant coefficient of

But then the inner product of the vectors corresponding to and is given by the coefficient in The result follows of immediately. We remark without giving a proof that if satisfies orthogonal we may assume that

is self-

(12) and

divides

where

and This makes it possible to search through all self-orthogonal additive cyclic codes of a given ranges over all divisors of dimension: ranges over all divisors of of the appropriate degree, and finally all choices for and must be considered. Table I lists some additive cyclic codes that were found in this way.

1378

IEEE TRANSACTIONS ON INFORMATION THEORY, VOL. 44, NO. 4, JULY 1998

Proof: a) The first assertion follows from Theorem 5, and the proof of the second assertion is parallel to that of [53, Theorem 13]. b) Parallel to the proof of [55, Corollary 3].

TABLE I CYCLIC CODES

(The result in b) has since been improved—see Section IX.)

Theorem 15: Let be an and form the binary code

additive conjucyclic code,

Theorem 17: a) The weight enumerator of an even self-dual code is a and polynomial in b) The minimal distance of an even self-dual code of length is Proof: a) This is an immediate consequence of [53, Theorem 13]. b) From [53, Corollary 15]. In view of the importance of doubly-even self-dual codes in binary coding theory, we also note the following result.

when the trace is applied componentwise and the bar denotes is a binary cyclic code of length , concatenation. Then which is self-orthogonal if and only if is self-orthogonal. We omit the proof. Note that

determines

, since

Theorem 15 makes it possible to search for codes of this type. So far, no record codes have been found. We now return to linear codes. A quasicyclic code is a code on which the group acts as cycles of of length length T. A. Gulliver of Carleton University (Canada) and the University of Canterbury (New Zealand) has extensively studied quasicyclic codes over small fields [39]. The last five examples in Table II were found by him. Double parentheses indicate the cycles of the permutation that is to be applied.

such that Theorem 18: If there is an integer constant the weight of every vector in a self-dual code is divisible by , then Proof: The proof of the Gleason–Prange theorem for classical self-dual codes over an alphabet of size as given in [71] applies unchanged. (Note that applying the Calderbank–Shor–Steane construction (cf. Theorem 9) to a doubly-even binary code does not give a code with weights divisible by . For example, the contains words GF -span of the Golay code of length of weight .) It is possible to give a complete enumeration of all selfdual codes of modest length, following the methods of [53] and [24]. Theorem 19: a) The total number of self-dual codes of length

is

VI. SELF-DUAL CODES In this section we study quantum-error-correcting self-dual codes These codes and their associated codes are of interest in their own right—for instance, the code corresponds to the quantum state unique , that is, an EPR pair. They are also codes with , as we important for constructing will see in Section VIII. We begin with some properties of weight enumerators of self-dual codes. Theorem 16: a) The weight enumerator of a self-dual code is fixed under the transformation replace

by

and and is, therefore, a polynomial in b) The minimal distance of a self-dual code of length is

(13)

b)

where the sum is over all inequivalent self-dual codes of length Proof: a) Parallel to that of [53, Theorem 19]. b) From a) and (6). Let be the binary vectors of length

code spanned by all even-weight and let

Theorem 20: Suppose is a self-orthogonal additive code, in which no coordinate is identically zero, and which is is equivalent to a generated by words of weight . Then

CALDERBANK et al.: QUANTUM ERROR CORRECTION VIA CODES OVER GF

1379

TABLE II LINEAR QUASICYCLIC CODES

direct sum

a unique additive code. This is the code having generator matrix

additive

Proof: Analogous to that of [24, Theorem 4]. With the help of Theorems 19 and 20 we find that the (respectively, ) of inequivalent (respectively, numbers inequivalent indecomposable) self-dual codes of length for are

This enumeration could be extended to larger values of without too much difficulty. The indecomposable codes mentioned in the above table are for , the length code the trivial code , the codes , the length codes

and

and a code obtained from the hexacode (see Section VIII) using Theorem 6. We have also investigated the highest achievable minimal distance of any self-dual code of length , or equivalently of quantum-error-correcting code. The results are any column of the main table (Section VIII). shown in the Of course, in view of Theorem 6 Part c) this also gives bounds code. on the minimal distance of any pure We see from that table that the bound in Theorem 17 for even self-dual codes is met with equality at lengths , , and . In all but one of those cases the code can be taken to be a classical self-dual linear code over GF The exception is at length , where although no classical self-dual codes exists with minimal distance [24], there is

which we will call the dodecacode. This code is equivalent to It has weight the cyclic code with generator distribution and its automorphism group has order and acts transitively on the coordinates. There is an interesting open question concerning length . There exists a classical code over GF , the Golay code, and at least two classical codes over GF , all meeting the analogous bounds to Theorem 17 Part b) [54]. It is known [51] that there is no classical code over GF , but the possibility additive self-dual code remains open. of a Linear programming shows that if such a code exists then it must be even. However, all our attempts so far to construct this code have failed, so it may not exist. VII. LINEAR PROGRAMMING AND OTHER BOUNDS Gottesman [36] showed that any nondegenerate code must satisfy the sphere-packing bound (14) Knill and Laflamme [47] have shown that any (pure or impure) code must satisfy the following version of the Singleton bound

1380

IEEE TRANSACTIONS ON INFORMATION THEORY, VOL. 44, NO. 4, JULY 1998

conditions hold:

(cf. [54]):

(22)

(15)

(23) is the number of errors correctable by where the code. In this section we first establish a linear programming codes, and then give a bound which applies to all slightly stronger version of the Singleton bound for pure codes. code exists, let be the corresponding Suppose an code over GF and let , an code, and be its dual (see Theorem 2). Let be the weight distributions of and , respectively. In view of Theorem 6 Part e), we may assume that (Only minor modifications to Theorem 21 are required if this assumption is not made.) The Krawtchouk polynomials appropriate for studying a will be denoted by code of length over GF

(24) (25) and (26) indicates that the coefficients of where are nonnegative. to be the weight enumerator of Proof: Take and to be the weight enumerator of is the shadow enumerator (by analogy with [25]) and is nonnegative by (21).

A more compact statement of the linear programming bound may be obtained by rephrasing Theorem 21 in terms of weight enumerators.

We have implemented Theorems 21 and 22 on the computer in two different ways. subject to i) We attempt to minimize (16)–(21) using an optimization program such as CPLEX [27] or CONOPT [32]. The AMPL language [35] makes it easy to formulate such problems and to switch from one package to another. If all goes well, the program either finds a solution (which may lead to additional discoveries about the code, such as that there must exist a vector of a particular weight), or else reports that no feasible solution exists, in which case we can code exists. conclude that no Unfortunately, for values of around , the coefficients may grow too large for the problems to be handled using double-precision arithmetic, and the results cannot be trusted.3 ii) Alternatively, using a symbolic manipulation program such as MAPLE [18], we may ask directly if there is a feasible solution to (16)–(21) or to (22)–(26) (the latter being easier to implement). Since the calculations are performed in exact arithmetic, the answers are (presumably) completely reliable. On the other hand, the calculations are much slower than when floating-point arithmetic is used. Most of the upper bounds in the main table were independently calculated using both methods. When investigating the possible existence of a pure code, we may set through equal to . In all cases within the range of Table III, this had no effect; that is, the LP bound for pure codes was the same as that for impure codes. We handle (20) by running the problem twice, once for each choice of the right-hand side. For example, using Theorem 21 we find that there are no codes of length for which has From Theorem 6, we conclude that no code of any On the other hand, an code type exists with does exist—see the following section.

quantum-error-correcting code Theorem 22: If an exists then there are homogeneous polynomials and of degree such that the following

3 It is hoped that the multiple precision linear programming package being developed by David Applegate of Rice University will soon remove this difficulty.

for

(see [54, Ch. 6]).

quantum-error-correcting code Theorem 21: If an code contains no exists such that the associated vectors of weight , then there is a solution to the following set of linear equations and inequalities: (16) (17) (18)

(19) or

(20)

(21) (If the second possibility obtains in (20), (21) just says that and can be omitted.) Proof: Equation (18) is a consequence of Theorem 5, and any vectors and (19) follows from the facts that of weights between and inclusive must also be in From (7), the even weight vectors in form an additive in subcode , which is either half or all of ; (20) then follows. is half of , then , which yields If (21). The other constraints are clear.

CALDERBANK et al.: QUANTUM ERROR CORRECTION VIA CODES OVER GF

1381

TABLE III HIGHEST ACHIEVABLE MINIMAL DISTANCE d IN ANY [[n; k; d]] QUANTUM-ERROR-CORRECTING CODE. THE SYMBOLS ARE EXPLAINED IN THE TEXT

Additional constraints can be included in Theorem 21 to reflect special knowledge about particular codes, or to attempt Many variations on to narrow the range of a particular the basic argument are possible, as illustrated in the following examples. code exists. Let be a additive i) No , and let be its even subcode. The code with linear constraints in Theorem 21 enable us to express all and The condition that the unknowns in terms of be integral implies certain the weight distribution of and , from which it is possible congruence conditions on The resulting congruence implies to eliminate In particular, , and so ii) No code exists. Consider the addiLinear programming shows that must contain tive code a vector of weight , which without loss of generality we We define the refined weight may take to be with respect to to be enumerator of

where is the weight of in the first six coordinates, and (respectively, is the number of ’s (respectively, ’s or ’s) in in the last 12 coordinates. The conditions on

imply that

and

By applying linear programming, we find that the weight must be either distribution of or In either case, adding these constraints to the refined weight enumerator produces a linear program with no feasible solution. iii) Similar arguments eliminate the parameters and . In the remainder of this section we briefly discuss another version of the Singleton bound [cf. (15)]. Theorem 23: If a pure

code exists then

Proof: The associated code is then an additive code with minimal distance From [28, Theorem 15], we have which implies

1382

IEEE TRANSACTIONS ON INFORMATION THEORY, VOL. 44, NO. 4, JULY 1998

TABLE III (Continued) HIGHEST ACHIEVABLE MINIMAL DISTANCE d IN ANY [[n; k; d]] QUANTUM-ERROR-CORRECTING CODE. THE SYMBOLS ARE EXPLAINED IN THE TEXT

If is odd this coincides with the Knill and Laflamme bound (15), but is slightly stronger if is even. We have determined all codes that meet this bound—these are analogs of the classical MDS codes (cf. [54, Ch. 11]). Since the results are somewhat disappointing we simply state the answer and omit the rather lengthy proof. code has parameters even or . Up to equivalence there is a unique code in each

Theorem 24: A pure

case. does not appear to lead Even allowing to any new codes. Further analysis shows that any pure code has parameters or . VIII. A TABLE OF QUANTUM-ERROR-CORRECTING CODES Table III, obtained by combining the best upper and lower bounds given in the previous sections, shows our present state of knowledge about the highest minimal distance in any code of length Notes on Table III When the exact value of is not known, the lower and upper bounds are separated by a dash. All unmarked upper bounds in the table come from the linear programming bound of Theorem 21. (A few of these

bounds can also be obtained from (14) or from Theorem 16.) Unmarked lower bounds are from Theorem 6. Note in particular that, except in the column, once a particular value of has been achieved, the same value holds for all lower entries in the same column using Theorem 6 Part a). A code meeting this upper bound must be impure (this follows from integer programming by an argument similar to code exists). that used in Section VII to show that no A special upper bound given in Section VII. These bounds do not apply to nonadditive codes, for which the upper bound must be increased by . This is the unique other entry in the table (besides those marked “ ”) where the known upper bound for nonadditive codes is different from the bound for additive codes: if we omit (21) (which says that the code is either odd or even) from the linear program, the bound increases by . In all other entries in the table, condition (21) is superfluous. nonadditive However, we will be surprised if a code exists. Most of the following lower bounds are specified by giving additive code. the associated a. The hexacode, a classical code that can span of be taken to be the GF (see [26, Ch. 3 ]). , of order . b. A classical self-dual code over GF —see [53], [24]. c. A cyclic code, see Table I.

CALDERBANK et al.: QUANTUM ERROR CORRECTION VIA CODES OVER GF

1383

TABLE III (Continued)

d. A code obtained by concatenating the Hamming code with itself (Fig. 1 of Section IV). e. The dodecacode defined in Section VI. code, discovered independently in [16], [36], f. An additive code may be generated by and [73]. The vectors

(where the double parentheses mean that all cyclic shifts of the enclosed string are to be used). Exhaustive search shows that this code is unique. Another version is obtained from , and is Theorem 10. The automorphism group has order the semidirect product of a cyclic group of order and the general affine group GF g. A quasicyclic code found by T. A. Gulliver—see Table II of Section V. h. A Hamming code, see Section V. and linear codes with generator i. Use the matrices

and

respectively. Their automorphism groups have orders and , and both act transitively on the coordinates. The first construction (c.f. of these can be obtained from the and Theorem 12) applied to the unique codes. code, for which the corresponding j. A code is a well-known linear code, a two-weight code of class TF3 [14]. The columns of the represent the 17 points of an ovoid generator matrix of Both and are cyclic, a generator for in PG being The weight distribution of is and its automorphism group . has order extended cyclic code spanned by k. The , together with vectors of all ’s and all ’s. s. By shortening one of the following codes using Theorem or 7 or its additive analogue: the Hamming codes (see Section V), the Gottesman code given in Table II or code (Theorem 10), the code shown in Fig. 2. the

1384

IEEE TRANSACTIONS ON INFORMATION THEORY, VOL. 44, NO. 4, JULY 1998

u. From the construction (see Theorem 12). code with trivial automorphism v. The following group found by random search (see the bottom of this page). Comparison of the table with the existing tables [11] of reveals a number of entries where classical codes over GF it may be possible to improve the lower bound by the use codes of linear codes. For example, classical linear certainly exist. If such a code can be found which over GF quantum code. contains its dual, we would obtain a

IX. SUBSEQUENT DEVELOPMENTS In the nearly two years since the manuscripts of [16] and the present paper were first circulated there have been a number of further developments. i) While we showed in Section II that the Clifford group suffices to encode additive codes, we did not give explicit recipes for doing so. Such recipes can now be found in Cleve and Gottesman [21]. ii) The Cleve and Gottesman technique applies only to real (not complex) codes. However, it can be shown [58] that any additive code is equivalent to a real additive code (and any linear code is equivalent to a real linear code), so this is not a severe restriction. iii) DiVincenzo and Shor [30] have shown how to correct errors in additive codes even when using imperfect computational gates. The techniques of Shor [66] for performing computations on encoded qubits using imperfect gates have been extended to general additive codes by Gottesman [37]. However, the most efficient methods currently known for fault-tolerant computation [2], [44], [48], [75] use only Calderbank–Shor–Steane codes (cf. Theorem 9). iv) It turns out that the proofs of the lower bounds on the capacity of quantum channels given in Bennett et al. [4], [5] and DiVincenzo, Shor, and Smolin [31] can be restated in terms of additive codes. In particular, this implies that these bounds can be attained using additive codes. v) Cleve [20] has found a way to apply asymptotic upper bounds for classical binary codes to additive codes. vi) Steane [74] has extended Gottesman’s [36] construction (compare Theorem 10) to obtain quantum analogues of Reed–Muller codes. The smallest of these new codes has . parameters ” vii) The upper bounds in the column headed “ in Table III (with the exception of the entries marked “ ”) have an obvious pattern with period . Further investigation bound for quantum codes (cf. of this pattern has led to an bound for classical Theorem 17) [58] and an analogous singly-even binary self-dual codes [57].

viii) The main construction in this paper (described in Section II) can be generalized to primes greater than . Some preliminary work along these lines has been done in [2], [45], [46], and [60]. ix) There are analogs of Parts a)–c) of Theorem 6 for nonadditive codes. Parts a) and c) are trivial, while Part b) code exists with now asserts that if a pure then an code exists [59]. x) How much of a restriction is it to use only additive quantum-error-correcting codes? We conjecture: Not much! So far essentially only one good nonadditive code has been code described in [62]. The best found. This is the code. The comparable additive code is a code can be used to construct a family of nonadditive codes for all [61]. with parameters code is optimal in that there exists no The code. It is not known if this is true for other codes in the family. The next candidate for a good nonadditive code is at length , code. where we have unsuccessfully tried to find a xi) Most of the upper bounds in this paper have only been proved to hold for additive codes. It turns out, however, that our strongest technique, the linear programming bound of Theorem 22, applies even to nonadditive codes with the (see [67]) and (see [58]). appropriate definitions of The sole change needed in the statement of Theorem 22 is must be replaced by that As a consequence, all but eleven of the upper bounds in Table III (those marked “ ” or “ ”) apply equally to nonadditive codes. xii) The purity conjecture. As we have already remarked, in the range of Table III the linear programming bound for pure codes is no stronger than that for impure codes. Moreover, for several entries in the table a code meeting the linear programming bound must be pure. This suggests the following conjecture. be the largest number (not necessarily Conjecture: Let an integer) greater than such that there exist polynomials as in the nonadditive version of Theorem 22. Then for any such solution

or in other words the weight enumerator is pure. This conjecture, together with a monotonicity condition on solutions to Theorem 22, would imply the equivalence of the pure and impure linear programming bounds for general (additive or nonadditive) codes. We have verified the conjecture for all xiii) Referring to the above conjecture, cases in which the are powers of are of particular interest. In extremal

CALDERBANK et al.: QUANTUM ERROR CORRECTION VIA CODES OVER GF

1385

TABLE IV PUTATIVE EXTREMAL QUANTUM-ERROR-CORRECTING CODES ((n; K; d)) IN WHICH K IS A POWER OF 2

the range these are listed in Table IV. A question mark indicates that no code with these parameters is presently known. is not a power There are also some candidates for which , and as mentioned above of . The first of these is we were able to find such a code. There is an infinite family , none of which can exist [61]. of other candidates with are The remaining possibilities for

It would be very interesting to have an elegant combinatorial construction for any of these codes. xiv) In Theorem 24 we listed all sets of parameters of the for which an additive code exists, form and remarked that in each case the code is unique. In [61] this result is extended to nonadditive codes. In particular, any code is equivalent additive to the unique , there exists code, respectively. On the other hand, for all code. a nonadditive xv) There is a remarkable story behind this paper. About two years ago one of us (P.W.S.) was studying fault-tolerant quantum computation, and was led to investigate a certain orthogonal matrices. P.W.S. asked another of group of us (N.J.A.S.) for the best method of computing the order of this group. N.J.A.S. replied by citing the computer algebra system

MAGMA [8]–[10], and gave as an illustration the MAGMA commands needed to specify a certain matrix group that had recently arisen in connection with packings in Grassmannian spaces. This group was the symmetry group of a packing of 70 four-dimensional subspaces of that had been discovered by computer search [22]. It too was an eight-dimensional group, . To our astonishment the two groups turned of order out to be identical (not just isomorphic)! We then discovered that this group was a member of an infinite family of groups that played a central role in a joint paper [12] of another of the , authors (A.R.C.). This is the family of real Clifford groups has order ). described in Section II (for This coincidence led us to make connections which further advanced both areas of research (fault-tolerant quantum computing [66] and Grassmannian packings [68]). While these three authors were pursuing these investigations, the fourth author (E.M.R.) happened to be present for a job interview and was able to make further contributions to the Grassmannian packing problem [13]. As the latter involved packings of -dimensional subspaces in dimensional space, it was natural to ask if the same techniques could be used for constructing quantum-error-correcting codes, which are also subspaces of -dimensional space. This question led directly to [16] and the present paper. (Incidentally, he got the job.) xvi) A final postscript. a) At the 1997 IEEE International Symposium on Information Theory, V. I. Sidelnikov presented a paper “On a finite group of matrices generating orbit codes on the Euclidean sphere” [70] (based on [69] and [43]). It was no surprise to discover that—although Sidelnikov did not identify them in this way—these were the Clifford groups appearing in yet another guise. b) We have also recently

1386

IEEE TRANSACTIONS ON INFORMATION THEORY, VOL. 44, NO. 4, JULY 1998

discovered that the complex Clifford groups L described in Section II have also been studied by Duke [33], Runge [63], [64], and Oura [56] in connection with multiple-weight enumerators of codes and Siegel modular forms. c) Many of the results in Section VI were independently discovered by in H¨ohn [40] who investigated self-dual codes over GF connection with lattices and vertex operator algebras. ACKNOWLEDGMENT The authors wish to thank Aaron Gulliver for finding the quasicyclic codes mentioned in Section V, and our colleague Ronald H. Hardin for his contributions to our search for interesting nonadditive codes. We also thank Patrick Sol´e for drawing our attention to the work of B. Runge and G. H¨ohn. Further Updates (March 1998) a) More information on self-dual codes can be found in the survey article “Self-dual codes” by E. M. Rains and N. J. A. Sloane in the Handbook of Coding Theory, V. Pless et al., Eds. Amsterdam, The Netherlands, North Holland, 1998, in press. b) J. Bierbauer and Y. Edel (“Quantum twisted codes,” preprint) and A. M. Steane (“Enlargement of Calderbank–Shor–Steane quantum codes,” LANL quantph/9802061, February 24, 1998) independently found codes. There is, in fact, a cyclic code, which has now been added to Tables I and III. c) It has been shown (“Monotonicity of the quantum linear programming bound,” E. M. Rains, LANL quantph/9802070) that the linear programming bound for quantum codes is monotonic, in the sense that if a exists, then the feasible enumerator for exists for all real feasible enumerator for . REFERENCES [1] M. Aschbacher, Finite Group Theory. Cambridge, U.K.: Cambridge Univ. Press, 1986. [2] D. Aharonov and M. Ben-Or, “Fault-tolerant quantum computation with constant error,” in Proc. 29th Annu. ACM Symp. Theory of Computing. ACM Press, 1997, pp. 176–188; also LANL e-print quant-ph/9611025. [3] C. H. Bennett, G. Brassard, C. Cr´epeau, R. Jozsa, A. Peres, and W. K. Wootters, “Teleporting an unknown quantum state via dual classical and EPR channels,” Phys. Rev. Lett., vol. 70, pp. 1895–1898, 1993. [4] C. H. Bennett, G. Brassard, S. Popescu, B. Schumacher, J. A. Smolin, and W. K. Wootters, “Purification of noisy entanglement and faithful teleportation via noisy channels,” Phys. Rev. Lett., vol. 76, pp. 722–725, 1996; also LANL e-print quant-ph/9511027. [5] C. H. Bennett, D. DiVincenzo, J. A. Smolin, and W. K. Wootters, “Mixed state entanglement and quantum error correction,” Phys. Rev. A, vol. 54, pp. 3824–3851, 1996; also LANL e-print quant-ph/9604024. [6] B. Bolt, T. G. Room, and G. E. Wall, “On Clifford collineation, transform and similarity groups I,” J. Australian Math. Soc., vol. 2, pp. 60–79, 1961. [7] , “On Clifford collineation, transform and similarity groups II,” J. Australian Math. Soc., vol. 2, pp. 80–96, 1961. [8] W. Bosma and J. Cannon, Handbook of Magma Functions, Sydney, May 22, 1995. [9] W. Bosma, J. J Cannon, and G. Mathews, “Programming with algebraic structures: Design of the Magma language,” in Proc. 1994 Int. Symp. Symbolic and Algebraic Computation, M. Giesbrecht, Ed. (Oxford, U.K., July 20–22, 1994). ACM, 1994, pp. 52–57. [10] W. Bosma, J. Cannon, and C. Playoust, “The Magma algebra system I: The user language,” J. Symb. Comp., vol. 24, pp. 235–265, 1997.

[11] A. E. Brouwer, “Tables of bounds on linear codes,” in Handbook of Coding Theory, V. Pless et al. Eds., 1998, to be published. [12] A. R. Calderbank, P. J. Cameron, W. M. Kantor, and J. J. Seidel, “ 4 Kerdock codes, orthogonal spreads, and extremal Euclidean line-sets,” Proc. London Math. Soc., vol. 75, pp. 436–480, 1997. [13] A. R. Calderbank, R. H. Hardin, E. M. Rains, P. W. Shor, and N. J. A. Sloane, “A group-theoretic framework for the construction of packings in Grassmannian spaces,” J. Alg. Comb., 1997, submitted for publication. [14] A. R. Calderbank and W. M. Kantor, “The geometry of two-weight codes,” Bull. London Math. Soc., vol. 118, pp. 97–122, 1986. [15] A. R. Calderbank, W.-C. W. Li, and B. Poonen, “A 2-adic approach to the analysis of cyclic codes,” IEEE Trans. Inform. Theory, vol. 43, pp. 977–986, May 1997. [16] A. R. Calderbank, E. M. Rains, P. W. Shor, and N. J. A. Sloane, “Quantum error correction and orthogonal geometry,” Phys. Rev. Lett., vol. 78, pp. 405–409, 1997; also LANL e-print quant-ph/9605005. [17] A. R. Calderbank and P. W. Shor, “Good quantum error-correcting codes exist,” Phys. Rev. A, vol. 54, pp. 1098–1105, 1996; also LANL e-print quant-ph/9512032. [18] B. W. Char et al., Maple V Library Reference Manual. New York: Springer-Verlag, 1991. [19] C. Chevalley, The Construction and Study of Certain Important Algebras, Math. Soc. Japan, 1955. Reprinted with corrections in C. Chevalley, Collected Works, vol. 2. New York: Springer-Verlag, 1997. [20] R. Cleve, “Quantum stabilizer codes and classical linear codes,” Phys. Rev. A, vol. 55, pp. 4054–4059, 1997; also LANL e-print quantph/9612048. [21] R. Cleve and D. Gottesman, “Efficient computations of encodings for quantum error correction,” Phys. Rev. A., vol. 56, pp. 76–82, 1997; also LANL e-print quant-ph/9607030. [22] J. H. Conway, R. H. Hardin, and N. J. A. Sloane, “Packing lines, planes, etc.: Packings in Grassmannian space,” Exper. Math., vol. 5, pp. 139–159, 1996. [23] J. H. Conway, S. P. Norton, R. A. Parker, and R. A. Wilson, ATLAS of Finite Groups. Oxford, U.K.: Oxford Univ. Press, 1985. [24] J. H. Conway, V. Pless, and N. J. A. Sloane, “Self-dual codes over F (3) and GF (4) of length not exceeding 16,” IEEE Trans. Inform. Theory, vol. IT-25, pp. 312–322, 1979. [25] J. H. Conway and N. J. A. Sloane, “A new upper bound on the minimal distance of self-dual codes,” IEEE Trans. Inform. Theory, vol. 36, pp. 1319–1333, 1990. , Sphere Packings, Lattices and Groups, 2nd ed. New York: [26] Springer-Verlag, 1993. [27] CPLEX Manual, CPLEX Organization Inc., Incline Village, NV, 1991. [28] P. Delsarte, “Bounds for unrestricted codes, by linear programming,” Philips Res. Rep., vol. 27, pp. 272–289, 1972. [29] D. Dieks, “Communication by EPR devices,” Phys. Lett. A, vol. 92, p. 271, 1982. [30] D. P. DiVincenzo and P. W. Shor, “Fault-tolerant error correction with efficient quantum codes,” Phys. Rev. Lett., vol. 77, pp. 3260–3263, 1996; also LANL e-print quant-ph/9605031. [31] D. P. DiVincenzo, P. W. Shor, and J. A. Smolin, “Quantum channel capacity of very noisy channels,” Phys. Rev. A, vol. 57, pp. 830–839, 1998, also LANL e-print quant-ph/9706061. [32] A. S. Drud, “CONOPT—A large scale GRG code,” ORSA J. Comput., vol. 6, pp. 207–218, 1994. [33] W. Duke, “On codes and Siegel modular forms,” Int.. Math. Res. Notices, vol. 5, pp. 125–136, 1993. [34] A. Ekert and C. Macchiavello, “Error correction in quantum communication,” Phys. Rev. Lett., vol. 77, pp. 2585–2588, 1996; also LANL e-print quant-ph/9602022. [35] R. Fourer, D. M. Gay, and B. W. Kernighan, AMPL: A Modeling Language for Mathematical Programming. San Francisco, CA: Scientific, 1993. [36] D. Gottesman, “A class of quantum error-correcting codes saturating the quantum Hamming bound,” Phys. Rev. A, vol. 54, pp. 1862–1868, 1996; also LANL e-print quant-ph/9604038. [37] , “A theory of fault-tolerant quantum computation,” Phys. Rev. A, vol. 57, pp. 127–137, 1998, also LANL e-print quant-ph/9702029. [38] , “Pasting quantum codes,” LANL e-print quant-ph/9607027. [39] T. A. Gulliver and V. K. Bhargava, “Some best rate 1=p and rate (p 1)=p systematic quasi-cyclic codes over GF (3) and GF (4),” IEEE Trans. Inform. Theory, vol. 38, pp. 1369–1374, 1992. [40] G. H¨ohn, “Self-dual codes over the Kleinian four group,” preprint, Aug. 16 , 1996. [41] B. Huppert, Endliche Gruppen. Berlin, Germany: Springer-Verlag, 1967. [42] N. Jacobson, Basic Algebra II. San Francisco, CA: Freeman 1980. [43] L. S. Kazarin, “On the Sidelnikov group” (in Russian), preprint, 1997.

G

0

CALDERBANK et al.: QUANTUM ERROR CORRECTION VIA CODES OVER GF

1387

[44] A. Kitaev, personal communication, 1997. [45] E. Knill, “Non-binary unitary error bases and quantum codes,” LANL e-print quant-ph/9608037. , “Group representations, error bases and quantum codes,” LANL [46] e-print quant-ph/9608048. [47] E. Knill and R. Laflamme, “A theory of quantum error-correcting codes,” Phys. Rev. A, vol. 55, pp. 900–911, 1997; LANL e-print quantph/9604034. [48] E. Knill, R. Laflamme, and W. Zurek, “Threshold accuracy for quantum computation,” LANL e-print quant-ph/9610011. See also, E. Knill, R. Laflamme, and W. Zurek,, “Resilient quantum computation,” Science, vol. 279, pp. 342–345, 1998. [49] F. R. Kschischang and S. Pasupathy, “Some ternary and quaternary codes and associated sphere packings,” IEEE Trans. Inform. Theory, vol. 38, pp. 227–246, 1992. [50] R. Laflamme, C. Miquel, J. P. Paz, and W. H. Zurek, “Perfect quantum error correction code,” Phys. Rev. Lett., vol. 77, pp. 198–201, 1996; also LANL e-print quant-ph/9602019. [51] C. W. H. Lam and V. Pless, “There is no (24; 12; 10) self-dual quaternary code,” IEEE Trans. Inform. Theory, vol. 36, pp. 1153–1156, 1990. [52] J. H. van Lint, Introduction to Coding Theory. New York: SpringerVerlag, 1982. [53] F. J. MacWilliams, A. M. Odlyzko, N. J. A. Sloane, and H. N. Ward, “Self-dual codes over GF (4),” J. Comb. Theory, Ser. A, vol. 25, pp. 288–318, 1978. [54] F. J. MacWilliams and N. J. A. Sloane, The Theory of Error-Correcting Codes. Amsterdam, The Netherlands: North-Holland, 1977. [55] C. L. Mallows and N. J. A. Sloane, “An upper bound for self-dual codes,” Inform. Contr., vol. 22, pp. 188–200, 1973. [56] M. Oura, “The dimension formula for the ring of code polynomials in genus 4,” Osaka J. Math., vol. 34, pp. 53–72, 1997. [57] E. M. Rains, “Shadow bounds for self-dual codes,” IEEE Trans. Inform. Theory, vol. 44, pp. 134–139, Jan. 1998. , “Quantum shadow enumerators,” LANL e-print quant[58] ph/9611001. [59] , “Quantum weight enumerators,” this issue, pp. 1388–1394, also LANL e-print quant-ph/9612015. , “Nonbinary quantum codes,” LANL e-print quant-ph/9703048. [60] , “Quantum codes of minimum distance two,” LANL e-print [61]

quant-ph/9704043. [62] E. M. Rains, R. H. Hardin, P. W. Shor, and N. J. A. Sloane, “A nonadditive quantum code,” Phys. Rev. Lett., vol. 79, pp. 953–954, 1997; also LANL e-print quant-ph/9703002. [63] B. Runge, “On Siegel modular forms I,” J. Reine Angew. Math., vol. 436, pp. 57–85, 1993. , “On Siegel modular forms II,” Nagoya Math. J., vol. 138, pp. [64] 179–197, 1995. [65] P. W. Shor, “Scheme for reducing decoherence in quantum memory,” Phys. Rev. A, vol. 52, p. 2493, 1995. , “Fault-tolerant quantum computation,” in Proc. 37th Symp. [66] Foundations of Computer Science. IEEE Computer Soc. Press, 1996, pp. 56–65; also LANL e-print quant-ph/9605011. [67] P. W. Shor and R. Laflamme, “Quantum analog of the MacWilliams identities in classical coding theory,” Phys. Rev. Lett., vol. 78, pp. 1600–1602, 1997; also LANL e-print quant-ph/9610040. [68] P. W. Shor and N. J. A. Sloane, “A family of optimal packings in Grassmannian manifolds,” J. Alg. Comb., vol. 7, pp. 157–163, 1998. [69] V. M. Sidelnikov, “On a finite group of matrices and codes on the Euclidean sphere” Probl. Pered. Inform., vol. 33, pp. 35–54, 1997 (in Russian). , “On a finite group of matrices generating orbit codes on the [70] Euclidean sphere,” in Proc. 1997 IEEE Int. Symp. Information Theory (Ulm, Germany, 1997). New York: IEEE Press, 1997, p. 436. [71] N. J. A. Sloane, “Self-dual codes and lattices,” in Relations Between Combinatorics and Other Parts of Mathematics, Proc. Symp. Pure Math., vol. 34. Providence, RI: Amer. Math. Soc., 1979, pp. 273–308. [72] A. M. Steane, “Multiple particle interference and quantum error correction,” Proc. Roy. Soc. London A, vol. 452, pp. 2551-2577, 1996; also LANL e-print quant-ph/9601029. , “Simple quantum error correcting codes,” Phys. Rev. Lett., vol. [73] 77, pp. 793–797, 1996; also LANL e-print quant-ph/9605021. [74] , “Quantum Reed–Muller codes,” LANL e-print quantph/9608026. [75] , “Space, time, parallelism and noise requirements for reliable quantum computing,” LANL e-print quant-ph/9708021. [76] G. E. Wall, “On Clifford collineation, transform and similarity groups IV,” Nagoya Math. J., vol. 21, pp. 199–222, 1962. [77] W. K. Wootters and W. H. Zurek, “A single quantum cannot be cloned,” Nature, vol. 299, p. 802, 1982.